Search This Blog

Powered by Blogger.

Blog Archive

Labels

Showing posts with label User Safety. Show all posts

ICBC London Branch Hit by Ransomware Attack, Hackers Steal 6.6TB of Sensitive Data

 

The London branch of the Industrial and Commercial Bank of China (ICBC) recently fell victim to a ransomware attack, resulting in the theft of sensitive data. According to a report by The Register, which references information posted on the hackers' data leak site, the bank has until September 13 to meet the ransom demand or risk the stolen data being publicly leaked.

The attack was orchestrated by a group called Hunters International, who claim to have exfiltrated 5.2 million files, amounting to 6.6 terabytes of sensitive information. Despite being a relatively new name in the ransomware scene, some experts believe Hunters International is a rebranded version of Hive, a notorious ransomware group that was dismantled by the FBI in July 2022. At that time, the FBI successfully infiltrated the Hive group, seizing decryption keys and halting its operations.

Emerging approximately a year ago, Hunters International has shifted its focus toward data theft rather than system encryption. Some cybersecurity researchers suggest that developing and deploying encryption tools is complex and time-consuming, making data theft alone an equally profitable, yet simpler, approach for the group.

ICBC, the world’s largest bank by total assets and market capitalization, is a state-owned financial institution in China. It provides a variety of banking services, including corporate and personal banking, wealth management, and investment banking. With an extensive global presence, ICBC plays a significant role in funding infrastructure projects both domestically and abroad.

As of now, ICBC has not made any public statements regarding the attack or responded to requests for comment.

Massive Data Leak Exposes Sensitive Information for Millions

 


A significant data breach has compromised the personal information of millions of individuals across the United States, United Kingdom, and Canada. The leaked data, obtained from a company called National Public Data, includes highly sensitive information such as names, mailing addresses, and social security numbers.

The leaked database, consisting of nearly 2.7 billion records, was reportedly offered for sale on the dark web. While the exact scope of the breach is still being investigated, numerous individuals have confirmed the presence of their personal data within the leaked files.

The exposed information poses a serious risk of identity theft and other malicious activities. Scammers may use this data to target individuals with phishing attempts or fraudulent transactions.

To protect yourself:

1. Be wary of suspicious emails: Avoid clicking on links or opening attachments in unsolicited emails, even if they appear to be from legitimate sources.
2. Verify the sender: Double-check the sender's email address to ensure it is authentic.
3. Use strong, unique passwords: Create complex passwords for all your online accounts and avoid reusing them across different platforms.
4. Monitor your accounts: Regularly check your bank statements, credit reports, and online accounts for any unauthorized activity.

If you believe your personal information may have been compromised in this data breach, it is recommended to take steps to protect your identity and report the incident to the appropriate authorities.

The Concerning Rise of AI “Undressing” Apps: A Violation of Privacy and Ethics

 

Today, AI can help with a variety of tasks, like making personalised food plans and offering dating advice, as well as fixing image flaws and optimising workflow.

However, AI technology has also opened the door to more controversial apps, such as AI nude generators used for AI undressing. AI undressing is becoming increasingly popular as a result of rapid technical breakthroughs and the interest it generates. These apps use deep learning algorithms to analyse and edit images, successfully removing clothing from photographs. 

Nevertheless, the usage of these apps raises serious legal and ethical concerns. Many of these apps have the potential to infringe private rights and be used maliciously, which could result in legal consequences. Responsible use of AI undressing apps is critical, but the potential for abuse and the difficulties of regulation remain significant hurdles.

In Israel, for example, there have been debates about implementing regulations similar to those governing revenge pornography, which would criminalise the unauthorised use of AI undressing apps. In addition, Israeli tech businesses and academic institutions are creating educational courses and guidelines to promote the appropriate use of AI. These initiatives aim to mitigate the negative effects of applications such as AI undressing while upholding ethical standards in technology use. 

One of the most pressing challenges concerning AI-powered undressing apps is whether they can be used properly. This is a complex subject that ultimately depends on individual notions of right and wrong, as well as the willingness to take the required measures to safeguard oneself and others from the possible harms that these apps can generate. 

The appropriate use of such technology necessitates a thorough awareness of its ramifications as well as a commitment to ethical principles. As AI evolves, it is critical for society to strike a balance between innovation and ethical responsibility. It is critical to ensure that technological breakthroughs are used to improve our lives while maintaining our values and safety. 

This includes establishing strong legal frameworks, raising awareness and educating about the risks, and cultivating an ethical AI culture. By doing so, we can maximise the benefits of AI while minimising its potential risks, resulting in a safer and more responsible technological landscape for everybody.

ERP Firm Data Breach Exposes Over 750 Million Records

 

A leading Enterprise Resource Planning (ERP) company based in Mexico inadvertently left an unsecured database online, exposing sensitive information on hundreds of thousands of users. This was discovered by cybersecurity researcher Jeremiah Fowler, who reported his findings to Website Planet. According to Fowler, the database contained 769 million records and was accessible to anyone who knew where to look.

The exposed data included highly sensitive and personally identifiable information such as API keys, secret keys, bank account numbers, tax identification numbers, and email addresses. The database, which is 395GB in size, belongs to ClickBalance, a software provider that offers a range of cloud-based business services including administration automation, accounting, inventory, and payroll.

Website Planet describes ClickBalance as one of Mexico’s largest ERP technology providers. Upon discovering the database, Fowler immediately contacted ClickBalance, which secured the database within hours. However, it remains unclear whether any malicious actors accessed the data before it was secured or whether the data has been used in any malicious activities. Fowler emphasizes that only a comprehensive forensic investigation can determine the full extent of the exposure.

The exposure of tax identification numbers and bank account details poses significant risks, enabling cybercriminals to conduct fraudulent activities. The theft of active email addresses is particularly concerning, as it allows criminals to launch phishing attacks that can deliver malware and ransomware.

Despite the severe potential consequences, unsecured databases continue to be a common cause of data breaches. Many large enterprises and government organizations have been found with online databases lacking adequate protection. For instance, a previous incident resulted in the personal information of the entire Brazilian population being leaked.

Here's Why You Shouldn't Use Public USB Charging Ports

 

We've all been there: stranded in a coffee shop with a dropping phone battery and no connector, only to find a free USB charging station nearby. Relieved, you plug in your device and go about your business, unaware that a potential threat lurks behind that seemingly benign USB port. 

That concern is "juice jacking," a cybersecurity vulnerability that has received enough attention in recent years to warrant an advisory from the FBI. So, what exactly is juice jacking and how risky is it? Here's all you need to know, along with some recommendations for keeping your mobile devices safe while charging on the road. 

What is juice-jacking? 

Juice-jacking is when hackers siphon your phone's data while it is charging. It achieves this using software placed in a kiosk that allows you to quickly charge your phone, or through a cable connected to a charging station. It can do this by plugging the USB charger directly into the socket. USBs, unlike two-pronged plugs, may transmit data as well as electricity. 

The methodology is similar to how a "skimmer" steals your bank or credit card information; however, juice-jacking has the potential to collect all of the data on your cell phone, including passwords, account information, contacts, emails, and so on. While this form of hacking is not yet widespread, it has the potential to become so. However, there are techniques to defend yourself from this type of hack. 

Prevention Tips 
  • Do not plug your phone directly into a USB charging port. Keep your data secure by using a 2-prong electrical charger.
  • Don't use the provided cord or someone else's 2-prong attachment since it might contain software designed to steal your information. 
  • Use a "sync stop" device to prevent attackers from accessing your phone. When charging your phone, leave it locked or switched off. 
  • Most phones cannot access your information while locked or switched off. Don't rely on others; bring your own personal power bank to charge your mobile device. 

When your phone's battery goes low in the airport, hotel, or coffee shop, be sure you're prepared to give it the power it requires without leaving you powerless.

Australian Man Arrested for Evil Twin Wi-Fi Attacks on Domestic Flights

 

Police in Australia have arrested and charged a man with nine cybercrime crimes for allegedly setting up fictitious public Wi-Fi networks using a portable wireless access point to steal data from unsuspecting users. 

The man designed "evil twin" Wi-Fi networks at airports, during flights, and other places related to his "previous employment" that would deceive people into registering into the fake network using their email address or social media accounts. Police stated the login data was then transferred to the man's devices. 

Dozens of credentials were reportedly obtained. This information might have enabled the perpetrator to get access to victims' accounts and possibly steal further sensitive information such as banking login details or other personal information. Employees of the airline noticed one of the strange in-flight Wi-Fi networks. The anonymous Australian airline then reported the Wi-Fi's presence to authorities, who investigated the situation in April and arrested the suspect in May. 

According to the Australian Broadcasting Corporation, the man, Michael Clapsis, appeared before Perth Magistrates Court and was subsequently released on "strict" bail with limited internet access. He also had to submit his passport. Clapsis' LinkedIn profile, which has since been deleted, hints that he may have previously worked for a shipping company. 

He has been charged with three counts of unauthorised impairment of electronic communication, three counts of possession or control of data with the intent to commit a serious offence, one count of unauthorised access or modification of restricted data, one count of dishonestly obtaining or dealing in personal financial information, and one count of possessing identification information with the intent to commit an offence. Clapsis is set to appear in court again in August. 

Evil twin attacks can use a variety of tactics to steal victims' data. However, they typically entail providing free Wi-Fi networks that appear genuine but actually contain "login pages" designed to steal your data. Genuine Wi-Fi networks should never ask you to login using your social media credentials or provide a password for any of your accounts. It is also recommended to use a VPN and avoid connecting to public Wi-Fi networks when a more secure option is available.

Android 15's Lockdown Mode Safeguards Your Phone Against "Juice Jacking"

 

You shouldn't use any random cable that is provided to you to charge your favourite Android phone—or any other device, for that matter—at a public charging station for a few very good reasons. More importantly, there are always a number of security issues, so you might not receive the fastest charging speeds. Even though they are not scalable, "juice jacking" attacks that weaponize charging stations are common; however, Android 15's Lockdown mode now includes defences against such types of attacks. 

Google is still working on Android 15, which is now in beta testing. The most recent development, spotted by apex tech sleuth Mishaal Rahman (via Android Authority), suggests that the operating system update will have built-in protections against fraudulent individuals who attempt to use juice-jacking devices. These attacks have the ability to install malicious apps, run commands, transmit malicious payloads to your device, and maliciously control how the USB connection handles data.

However, Rahman claims there is no reason to be concerned about juice jackers because Android currently prevents you from enabling USB Debugging before you unlock your smartphone. Access to files on the device is similarly restricted until you change the USB connection mode to explicitly allow file transfers. These safety nets work together to prevent attempts to execute ADB commands or tamper with your device's files. Lockdown mode, on the other hand, takes safety to the next level, and it just gets better with Android 15.

Put things on lockdown

Lockdown mode, which was introduced as a safety feature alongside Android 9 in 2018, was made available as a default in the power menu on Pixel phones with Android 12. Other device manufacturers are free to place the option elsewhere, but once selected, it disables all notifications and requires your original PIN, password, or pattern to restore device functionality.

After testing with a Pixel 6 Pro running Android 15 and another device running Android 14, Rahman confirmed that the most recent firmware prevents USB data access. Any current connections to the ADB terminal or linked input devices are likewise terminated when Lockdown mode is enabled. It should work as soon as eligible Pixel phones receive the Android 15 upgrade, but other OEMs must update their devices' USB HAL to include the necessary APIs for this implementation to function. 

In any case, the Android 15 upgrade includes additional safeguards against juice jacking, even if you were already adequately protected on older versions. However, it's worth noting that taking precautions like avoiding unfamiliar chargers at airports and malls is the greatest and most effective defense.

An Unusual Tracking Feature Identified on Millions of iPhone Users

 

Millions of iPhone users across the globe discovered an interesting new setting that was automatically switched on in their iPhones. The latest software version included a new setting called "Discoverable by Others''. It can be located under 'Journalling Suggestions' in iPhone's privacy and security settings. Journalling Suggestions was included in the new Journal app, which was launched with iOS 17.2 in December 2023. 

When enabled, the feature accesses past data stored on the user's iPhone. Music, images, workouts, who they've called or texted, and significant locations are all included in the data. It is used to suggest what times to write about in the Journal app.

The feature is enabled by default and stays so even after a user deletes the Journal app. According to Joanna Stern, a senior personal technology correspondent for The Wall Street Journal, Apple has confirmed that customers' phones can use Bluetooth to locate nearby devices associated with their contact list. However, the phone does not save any information about the detected contacts. This feature offers context to enhance Journalling suggestions.

The firm has also denied disclosing users' identities and locations to anyone. To clarify their point, Apple provided an example of holding a dinner party at your home with pals listed in your contacts. According to the tech behemoth, the system may prioritise the event in Journalling Suggestions. This is because it recognises that the number of guests made it more than just another night at home with your family.

As per Apple's support page, if you disable the 'Discoverable by Others' option to avoid yourself from being counted among your contacts, the 'Prefer Suggestions with Others' feature will also be turned off. This implies that the Journalling Suggestions feature will be unable to determine the number of devices and contacts in your vicinity.

Authorities Warn of AI Being Employed by Scammers to Target Canadians

 

As the usage of artificial intelligence (AI) grows, fraudsters employ it more frequently in their methods, and Canadians are taking note. According to the Royal Bank of Canada’s (RBC's) annual Fraud Prevention Month Poll, 75% of respondents are more concerned with fraud than ever before. Nine out of 10 Canadians feel that the use of AI will boost scam attempts over the next year (88%), thereby making everyone more exposed to fraud (89%).

As per the survey, 81 percent of Canadians think that AI will make phone fraud efforts more difficult to identify, and 81 percent are worried about scams that use voice cloning and impersonation techniques. 

"With the recent rise in voice cloning and deepfakes, fraudsters are able to employ a new level of sophistication to phone and online scams," stated Kevin Purkiss, vice president, Fraud Management, RBC. "The good news is that awareness of these types of scams is high, but we also need to take action to safeguard ourselves from fraudsters.”

The study also discovered that phishing (generic scams via email or text), spear phishing (emails or texts that appear authentic), and vishing (specific phone or voicemail scams) were among the top three types of fraud. More than half also report an increase in deepfake frauds (56%), while over half (47%) claim voice cloning scams are on the rise. 

Prevention tips

Set up notifications for your accounts, utilise multi-factor authentication whenever possible, and make the RBC Mobile App your primary banking tool. Keep an eye out for impersonation scams, in which fraudsters appear to be credible sources such as the government, bank employees, police enforcement, or even a family member. 

Some experts also recommend sharing a personal password with loved ones to ensure that you're conversing with the right individual. 

To avoid robo-callers from collecting your identity or voice, limit what you disclose on social media and make your voicemail generic and short. Ignore or delete unwanted emails and texts that request personal information or contain dubious links or money schemes.

Vans Warns Consumers of Fraudsters Following ALPHV Data Breach

 

Vans customers have been alerted to the possibility of fraud or identity theft as a result of an ALPHV data breach at the parent firm. 

Vans claims that in December 2023, VF Group discovered "unauthorised activities" on a section of its IT systems. It also claimed that no passwords or detailed financial data were stolen.

However, it also stated that "it cannot be excluded" and that attackers may try to make use of the customer data they had taken hold of. The North Face, Dickies, Timberland, and other brands are owned by VF Group.

In an email to its customers, Vans stated that the data breach was discovered by VF Group on December 13 and was "apparently carried out by external threat actors."

The firm says it "immediately took steps" to address the threat, which included shutting down affected IT systems and hiring cybersecurity experts. By 15 December, it says, the hackers were ejected. 

"Our investigation revealed that the incident has affected some personal information of our customers that we normally store and process in order to manage online purchases, such as email address, full name, phone number, billing address, and shipping address," the email reads. 

However, it stated that the company did not "collect or retain" payment or financial data, such as bank account or credit card information, therefore there was "no chance that any detailed financial information was exposed to the threat actors." 

It said that no customers had been affected as of yet, but warned that the issue "may result in attempts at identity theft, phishing, and possibly fraud in general." 

It has warned users to be wary of unfamiliar emails, texts, and phone calls seeking personal information. Vans says it has informed the relevant law enforcement agencies and will evaluate its cybersecurity protocols.

Beware of Malicious YouTube Channels Propagating Lumma Stealer

 

Attackers have been propagating a Lumma Stealer variant via YouTube channels that post videos about cracking into popular applications. They prevent detection by Web filters by spreading the malware over open source platforms like MediaFire and GitHub rather than proprietary malicious servers. 

The effort, according to FortiGuard researchers, is reminiscent of an attack that was uncovered in March of last year and employed artificial intelligence (AI) to disseminate step-by-step installation manuals for programmes like Photoshop, Autodesk 3ds Max, AutoCAD, and others without a licence. 

"These YouTube videos typically feature content related to cracked applications, presenting users with similar installation guides and incorporating malicious URLs often shortened using services like TinyURL and Cuttly," Cara Lin, Fortinet senior analyst, wrote in a blog post. 

Modus operandi 

The attack begins with a hacker infiltrating a YouTube account and publishing videos pretending to offer cracked software tips, along with video descriptions carrying malicious URLs. The descriptions also lure users to download a.ZIP file containing malicious content. 

The videos identified by Fortinet were uploaded earlier this year; however, the files on the file-sharing site are regularly updated, and the number of downloads continues to rise, suggesting that the campaign is reaching victims. "This indicates that the ZIP file is always new and that this method effectively spreads malware," Lin stated in a blog post. 

The .ZIP file contains an.LNK file that instructs PowerShell to download a.NET execution file from John1323456's GitHub project "New". The other two repositories, "LNK" and "LNK-Ex," both contain .NET loaders and use Lumma as the final payload.

"The crafted installation .ZIP file serves as an effective bait to deliver the payload, exploiting the user's intention to install the application and prompting them to click the installation file without hesitation," Lin wrote.

The .NET loader is disguised with SmartAssembly, a valid obfuscation technique. The loader then acquires the system's environment value and, after the number of data is correct, loads the PowerShell script. Otherwise, the procedure will depart the programme.

YouTube malware evasion and caution

The malware is designed to prevent detection. The ProcessStartInfo object starts the PowerShell process, which eventually calls a DLL file for the following stage of the attack, which analyses the environment using various methods to avoid detection. The technique entails looking for debuggers, security appliances or sandboxes, virtual machines, and other services or files that could impede a malicious process. 

"After completing all environment checks, the program decrypts the resource data and invokes the 'SuspendThread; function," Lin added. "This function is employed to transition the thread into a 'suspended' state, a crucial step in the process of payload injection.” 

Once launched, Lumma communicates with the command-and-control server (C2) and establishes a connection to transfer compressed stolen data back to the attackers. Lin observed that the variation employed in the campaign is version 4.0, but its exfiltration has been upgraded to use HTTPS to better elude detection. 

On the other hand, infection is trackable. In the publication, Fortinet provided users with a list of indications of compromise (IoCs) and cautionary advice regarding "unclear application sources." According to Fortinet, users should make sure that any applications they download from YouTube or any other platform are from reliable and safe sources.

1.5 Billion Real Estate Records Leaked, Including Elon Musk and Kylie Jenner

 

Jeremiah Fowler, a cybersecurity researcher, uncovered and notified VPNMentor about an exposed database related to the New York-based online business Real Estate Wealth Network. The compromised database had 1.5 billion records, including real estate ownership data for millions of people. 

The database, which had a total size of 1.16 TB (1,523,776,691 records), had organised folders containing information on property owners, sellers, investors, and internal user tracking data. It included daily logging records from 4/22/23 to 10/23/23 that included internal user search data. 

Cameron Dunlap founded Real Estate Wealth Network in 1993 to provide education and resources for real estate investors. The platform costs a one-time, non-refundable fee of $1,450 for access to a vast collection of data, which includes online courses, training materials, a community, and mentorship/coaching from experienced experts. 

Upon further investigation, Fowler discovered that the exposed database contained the purported property ownership data of celebrities including Kylie Jenner, Blake Shelton, Britney Spears, Floyd Mayweather, Dave Chappelle, Elon Musk & Associates LLC, Dolly Parton, Donald J. Trump, Mark Wahlberg, and Nancy Pelosi. 

The online disclosure of celebrities' addresses could pose a number of threats, including concerns for their safety, invasion of privacy, stalking, and harassment by fans or malicious people. 

"The data was organised in various folders according to property history, motivated sellers, bankruptcy, divorce, tax liens, foreclosure, home owner association (HOA) liens, inheritance, court judgements, obituary (death), vacant properties, and more," VPNMentor’s blog post read. 

Everyone, famous or not, is at risk because real estate tax data, which includes information on property ownership, assessed property values, tax assessment history, and property tax payment history, can be used by criminals to gather personal information on property owners. 

Threat actors can utilise the data to target individuals with social engineering or phishing attacks, with the goal of obtaining financial or other personal information. The disclosure of data revealing whether a person bought their home with cash, without a mortgage loan, or has fully paid off their mortgage may increase the risk of financial fraud.

Property and mortgage fraud remain major issues, with the FBI reporting 11,578 incidents resulting in $350 million in losses in a single year, a 20% rise from 2017. Typically, property fraud entails taking a homeowner's identity and fabricating ownership documentation. 

Although the disclosed database has been locked from public access, a Real Estate Wealth Network representative confirmed ownership. The duration of the exposure and the possibility of unauthorised entry remains unknown. Only a forensic audit conducted internally could determine whether the records were accessed, extracted, or downloaded. 

This incident serves as a clear warning of the possibility of fraudulent activity involving easily accessible information. Property owners should be vigilant when disclosing personal information, especially in response to unsolicited requests for property information. Understanding the risks associated with semi-public data is critical for asset protection.

Here's Why You Need To Protect Private Data Like It’s Currency

 

Data is the currency of the information age. We'd all be a lot better off if we treated data as though it were money because we'd be considerably more cautious about who we let access to it and with whom we share it. Brick-and-mortar banks physically safeguard our money with security measures like alarm systems, bank guards, and steel-walled vaults, so we feel comfortable entrusting them with our hard-earned money. 

But far too frequently, we trust third parties to hold our personal information without the data equivalent of alarms, guards, and vaults. The businesses that we trust with our private data appear to be concealing it under their digital mattresses and hoping that no one breaks in while they are away. 

No data currency is more private or valuable to us than our healthcare information, making it the most significant privacy risk in the United States today. The government incentivizes and penalises healthcare providers who do not use electronic medical records. The authorised electronic sharing of patient information between doctors enables for faster and more accurate patient treatment, ultimately saving lives and money. 

However, if the data cannot be safeguarded, the apparent benefits do not exceed the risks involved.Policymakers felt they could regulate privacy, forcing the American healthcare system to digitise private information before it could secure security. 

As a result, simply the possibility of a breach can deter people from getting the necessary medical attention. One in every eight patients, for example, compromises their health in order to safeguard their personal privacy by postponing early diagnosis and treatment and concealing other crucial information. The fear of losing control of their privacy prevents millions of people from seeking medical assistance, particularly those suffering from stigmatising diseases such as cancer, HIV/AIDS, other sexually transmitted diseases, and depression. 

Electronic medical records are supposed to benefit our health, but they are instead contributing to a loss of trust in the medical profession and ultimately a more unhealthy society. 

 Mitigation tips

To address these dangers, numerous approaches for protecting data from unauthorised access and manipulation have been developed. In this article, we will go through the top three data security methods. 

Encryption: It is a critical component of personal data security. It entails turning sensitive information into a coded format, rendering it unintelligible to anyone who lacks the necessary decryption key. Only the authorised user with the decryption key can decode and access the information. 

This technology is commonly used to encrypt sensitive data during internet transmission as well as data saved on devices such as laptops and mobile phones. Furthermore, encryption technologies like AES and RSA are employed to scramble the data, making it nearly hard for unauthorised people to access it. 

Backup and recovery: Data backup is an important part of data security since it ensures that data is saved in the case of data loss or corruption. Companies can quickly recover their data in case of a disaster by making copies of their data and storing them in a secure location. 

Many businesses choose cloud-based storage services like TitanFile because they provide a safe and dependable way to store and restore data. Experts also recommend adopting the 3-2-1 strategy for data backup. The 3-2-1 data backup method involves making three copies of data and storing them on two local devices (the original device and an external hard drive) and one off-site (cloud-based). 

Access control: It is a means of limiting authorised users' access to sensitive information. Passwords, multi-factor authentication, and role-based access control can help with this. These approaches ensure that sensitive data is only accessed by those who have the right authorisation, lowering the risk of data breaches and unauthorised access.

Mozilla Report Calls Modern Cars a 'Privacy Nightmare'

 

Modern automotive technology enables some very special and convenient features. They're essentially four-wheeled smartphone extensions. As fantastic as it is to start a vehicle with a phone app or to have it self-park, there is a downside.

The Mozilla Foundation claimed in its latest report that cars are "the official worst category of products for privacy" it has ever analysed. 

The global nonprofit discovered that 84% of the reviewed automakers shared user data with third parties, giving users little (if any) control over their personal information.

None of the 25 automakers examined for the report satisfied the nonprofit organisation's minimal privacy standards, including Ford, Toyota, Volkswagen, BMW, and Tesla, which was also identified to be accumulating more personal information from customers than necessary. 

Data collected spans from personal information, such as medical information, to information about how drivers use the vehicle itself, such as how fast they drive, where they go, and even what music they are listening to. 

Both Nissan and Kia are known to permit the gathering of data about a user's sexual life. In comparison, Mozilla claims that 37% of mental health applications (which are also known for having bad data privacy practices) had superior practices for collecting and using private data.

According to the report, 84 percent of the evaluated car brands share users' personal information with service providers, data brokers, and perhaps dubious companies, with 76 percent claiming the right to sell such information. 56 percent of users are willing to provide information upon request to the government and/or law enforcement. 

With flags in every privacy category, Tesla received the lowest overall brand score in the survey and did so just twice. Following a number of collisions and fatalities, Tesla's AI-powered autopilot was criticised as "untrustworthy."

In addition to the research, Mozilla published a breakdown of how automakers acquire and share user data. This can include basic information such as the user's name, address, phone number, and email address, as well as more sensitive information such as images, calendar entries, and even specifics like the driver's race, genetic makeup, and immigration status. 

According to Mozilla, it was unable to establish if any of the automakers could meet the group's baseline security requirements for data encryption and theft protection. Indeed, it claims that, when compared to automobiles, dating apps and even sex toys frequently offer more comprehensive security information about their products. 

“While we worried that our doorbells and watches that connect to the internet might be spying on us, car brands quietly entered the data business by turning their vehicles into powerful data-gobbling machines,” stated Mozilla in the report. 

Mozilla claims to have spent more than 600 hours—three times as long per product as it typically does—researching the privacy policies of car manufacturers. The organisation claimed that because of how critical the report was, the recommendations it generally gives to assist clients protect their personal data feel like "tiny drops in a massive bucket." 

Instead, the Mozilla Foundation has launched a petition asking automakers to halt the data collecting initiatives from which they are unfairly profiting, saying that "our hope is that increasing awareness will encourage others to hold car companies accountable for their terrible privacy practises."

Apple Seeks to Defuse a French iPhone 12 Issue as EU Inquiry Intensifies

 

In order to resolve a dispute concerning radiation levels, Apple pledged on Friday to upgrade the software on iPhone 12s in France. However, concerns in other European nations suggested Apple might need to take similar steps abroad. 

France suspended sales of iPhone 12 phones this week after tests revealed violations of radiation exposure regulations.

Apple refuted the findings, claiming that the iPhone 12 was approved by numerous international organisations as meeting all worldwide requirements, but announced on Friday that it would release a software update to take into account the French testing procedures. 

Over the past two decades, numerous studies have been undertaken to evaluate the health concerns related to mobile phones. The World Health Organisation claims that there is no evidence linking them to any negative health impacts. However, the radiation warning in France, which was based on test results that were different from those of other nations, has raised worries across Europe.

The Belgian state secretary for digitalization stated that he had urged Apple to update the software on the iPhone 12 across the EU, despite the fact that, according to the regulator's own preliminary analysis, the device poses no risk to customers. 

Italy was preparing to ask Apple to upgrade the software on iPhone 12s there, according to a government source in Rome, while Germany claimed it was in contact with French authorities to find an EU-wide solution. The conclusion of the French probe will come first, a second Italian government source claimed, and only then would Italian officials make any requests of Apple or take any independent actions.

The Dutch Authority for Digital Infrastructure stated that it is in contact with Apple as well as German and French authorities and is also conducting its own inquiry, which is due in two weeks. The organisation reported that it had received calls from customers who were worried. 

The French authorities welcomed Apple's software update, saying it will be quickly evaluated and would allow sales of the relatively old iPhone 12 model, which was released in 2020, to resume.

"We will issue a software update for users in France to accommodate the protocol used by French regulators. We look forward to iPhone 12 continuing to be available in France," Apple stated. "This is related to a specific testing protocol used by French regulators and not a safety concern."

BianLian Ransomware Gang Siphons 6.8TB of Data from Save The Children

 

One of the biggest and oldest charities in the world, Save the Children, has admitted it was a victim of a ransomware attack by the BianLian operation. The attack first came to light on Monday, September 11, when details concerning the assault were posted to the gang's leak site. 

The attack was originally tracked by VX Underground and Brett Callow of Emsisoft. VX Underground declared that the gang needed "to be punched in the face," which is a statement that is difficult to dispute. 

Save the Children was not specifically mentioned at first by BianLian, who instead claimed to have struck "the world's leading non-profit organisation, employing around 25,000 staff and operating in 116 countries" with $2.8 billion in revenue. 

The charity's own boilerplate matches some of this description, but BianLian's assessment of Save the Children's financial situation seems to be wildly off; the organisation's entire revenue in 2022 was £294m. 

It claimed to have stolen 6.8TB of data, including 800GB of the charity's financial data, along with data on its human resources department, as well as individual users' personal information, including their health and medical records and email texts.

The BianLian ransomware gang is largely unknown, and although its name refers to a type of Chinese opera from Sichuan Province, it is far more likely that the group is a Russian-speaking one. It was one of many crews that appeared during 2022, ascending around the same time as groups like Black Basta, Hive, and Alphv/BlackCat and establishing themselves as a successful criminal organisation. 

It joined the group of ransomware groups that, as of 2023, have shifted away from encrypting the data of their victims and instead prefer to just grab it and demand payment in exchange for a promise not to disclose it. 

The US Cybersecurity and Infrastructure Security Agency (CISA) claims that BianLian generally uses legitimate Remote Desktop Protocol (RDP) credentials to access its victims' systems and makes use of a number of open source tools and command-line scripting for credential harvesting. 

It uses a variety of techniques to steal their data, most commonly using File Transfer Protocol (FTP) and legal cloud storage and file transfer services like Rclone and Mega. It makes a show of printing its ransom note on printers on its networks to put pressure on its victims, and staff of victimised companies have reported receiving threatening phone calls from individuals posing as group members.

Vishing Scams: Here's How to Spot & Defend Against Them

 

Vishing (voice or VoIP phishing) is a sort of cyber attack that uses voice and telephony technologies to deceive targeted persons into disclosing sensitive data to unauthorized entities. 

The information could be personal, such as a Social Security number or details about a financial account, or it could be tied to a commercial environment. For example, fraudsters may use vishing to entice an employee to provide network access information.

In 2022, "38% of the reports submitted to the FTC by consumers ages 80+ indicated phone calls as the initial contact method," according to Ally Armeson, executive program director of Cybercrime Support Network. (Calls were the most popular mode of contact for this age group.)"

"Vishing, also known as voice phishing," Aremson continues, "is a growing threat in the world of cybercrime, particularly targeting the elderly."  

The scam takes advantage of the fact that the elderly are more likely to trust phone contacts by impersonating false charities, appearing as relatives, or pretending to be trustworthy locations like government agencies. 

As a result, sharing credit card information, social security numbers, login credentials, or other valuable data is likely.

How to defend yourself?

  • Take the effort to confirm the caller's identification by visiting the organization's website.
  • Never give up personal or financial information over the phone. Legitimate organizations will never ask for credit card information, social security numbers, or passwords.
  • Do not be hesitant to call into question the legitimacy of unknown numbers. Legitimate organizations will never ask for credit card information, social security numbers, or passwords.
  • Don't be hesitant to question the legitimacy of unknown phone numbers, and be wary of providing important information over the phone without first verifying the caller's identity.
  • Since caller ID can be easily spoofed, don't rely on it alone to decide whether a call is real. I recommend remaining attentive and exercising caution while disclosing sensitive information.
  • Any unknown phone caller should be routed to voicemail so you can screen the call. Remember to notify the FTC of any unusual calls or suspected fraudulent activities at ReportFraud.ftc.gov.
  • In general, do not give any financial or Social Security information over the phone, by text, or via email.  
By following these tips, you can help protect yourself from vishing scams

Here's How Hackers Sell and Trade Your Data in the Metaverse

 

Your data might be lost in the metaverse, a place where reality takes on new forms and lovely virtual landscapes arise. 

Imagine yourself in a bustling digital marketplace, surrounded by avatars dressed in the latest digital attire. A secret underground network is concealed in the metaverse's shadowy side while you're taking in all the sights and sounds. Here, data sellers and hackers can be found together, chatting about the most recent hacks and online theft. 

Darkverse: A flip side of metaverse

If you're not sure what the darkverse is, think of the wild west of the digital world; it's a place where wicked acts flourish in the absence of law. Cybercriminals, hackers, and other malicious actors dwell in this shadowy domain and operate outside the bounds of morality and the law, significantly jeopardising the stability and security of the metaverse. 

Identity theft, fraud, and data breaches are commonplace in the darkverse, preying on unsuspecting users who take a chance in this dangerous environment. Automated bots roam freely, spamming and deceiving innocent users, while cutting-edge AI and deepfake technology generate fake data, obscuring a matter of truth and reliability. 

What type of data is sold on metaverse? 

Cybercriminals have adapted to this environment by selling all forms of stolen data to the highest bidders, and metaverse data marketplaces are similarly active. Personal data, which can include your name, address, phone number, and other information, comes first on the list. 

Identity theft is common in the metaverse, as malicious actors might adopt your online persona for profit or other reasons. So, before you go in, it's useful to learn about the most common metaverse crimes. 

Another noticeable commodity is financial data. Credit card information, bank account information, and digital wallets are highly sought after because cybercriminals can use this information to conduct unauthorised transactions, depleting victims' accounts in the blink of an eye. 

Access credentials are another common item on the illicit market. If hackers obtain your usernames and passwords, they will gain access to your digital life and cause havoc on your social media, emails, and more vital accounts. In virtual worlds and blockchain-based games, rare skins, strong weaponry, and one-of-a-kind artefacts are stolen and sold for real-world cash. 

Finally, private communications containing sensitive information are a bonanza for hackers. They'll try to pry into your personal communications, gathering compromising information to use against you or sell to the highest bidder. 

Mitigation tips 

Since the metaverse has yet to make an appearance, little can be said about how to address these challenges. So far, people's hopes are aligned with Zuckerberg himself. He might develop a robust cybersecurity structure for the metaverse and implement techniques to assure data privacy and security.

However, given the privacy concerns that have emerged as a result of the idea, there are a few ways that users, whether companies or individual netizens, can secure data privacy and security within the metaverse. 

Organisations can govern the use of such information because accumulating personal information and surveillance is not something that anyone other than Facebook can control. Any organisation that establishes virtual offices in the metaverse should have stringent data privacy and security rules in place. Users should be able to control how much personal information they are willing to reveal. 

Aside from that, organisations using AR/VR devices or platforms should rigorously monitor the risks of hack assaults, data breaches, and other hostile attacks. Similarly, these organisations will need to plan ahead of time for hostile AI attacks and enable defence against them. 

Individual users who join the metaverse should be cautious about the amount and type of information they reveal. Furthermore, it is critical that they implement internet security measures meant to safeguard customers from privacy intrusions and data breaches.

LastPass Security Breach Linked to Series of Crypto Heists, Say Experts

 

Security experts allege that some of the LastPass password vaults, which were stolen in a security breach towards the end of 2022, have now been successfully breached, leading to a series of substantial cryptocurrency thefts. 

According to cybersecurity blogger Brian Krebs, a group of researchers has uncovered compelling evidence linking over 150 victims of crypto theft to the LastPass service. The combined value of the stolen cryptocurrency is estimated to be over $35 million, with a frequency of two to five high-value heists occurring each month since December 2022.

Taylor Monahan, the lead product manager at MetaMask, a cryptocurrency wallet company, and a prominent figure in the investigation, noted that the common denominator among the victims was their prior use of LastPass to safeguard their "seed phrase" – a confidential digital key necessary to access cryptocurrency investments. 

These keys are typically stored on secure platforms like password managers to thwart unauthorized access to crypto wallets. Furthermore, the pilfered funds were traced to the same blockchain addresses, further solidifying the connection between the victims.

LastPass, a password management service, experienced two known security breaches in August and November of the previous year. 

During the latter incident, hackers utilized information acquired from the first breach to gain access to shared cloud storage containing customer encryption keys for vault backups. We have contacted LastPass to verify if any of the stolen password vaults have indeed been breached and will provide an update if we receive a response.

LastPass CEO Karim Toubba informed The Verge in a statement that the security breach in November is still under active investigation by law enforcement and is also the subject of pending litigation. The company did not confirm whether the 2022 LastPass breaches are related to the reported crypto thefts.

Researcher Nick Bax, who holds the position of Director of Analytics at crypto wallet recovery company Unciphered, also examined the theft data and concurred with Monahan’s conclusions in an interview with KrebsOnSecurity:

“I’m confident enough that this is a real problem that I’ve been urging my friends and family who use LastPass to change all of their passwords and migrate any crypto that may have been exposed, despite knowing full well how tedious that is.”

Flight Data Issues Trigger UK Air Traffic Control Failure

 

A significant air traffic control malfunction resulted in extensive flight disruptions, leaving numerous passengers stranded both domestically and internationally. The root cause of this disruption was attributed to issues with the reception of flight data.

Martin Rolfe, the CEO of National Air Traffic Services (Nats), disclosed that the primary and backup systems experienced a suspension of automatic processing during the incident. In his statement, Mr. Rolfe clarified that there is no evidence to suggest that the malfunction was the result of a cyber-attack.

Furthermore, Mr. Rolfe sought to provide assurance by emphasizing that all Nats systems have been operating normally since Monday afternoon, effectively supporting the seamless functioning of airlines and airports.

He said: ‘Very occasionally technical issues occur that are complex and take longer to resolve.  In the event of such an issue our systems are designed to isolate the problem and prioritise continued safe air traffic control. This is what happened yesterday. At no point was UK airspace closed but the number of flights was significantly reduced. Initial investigations into the problem show it relates to some of the flight data we received.'

‘Our systems, both primary and the back-ups, responded by suspending automatic processing to ensure that no incorrect safety-related information could be presented to an air traffic controller or impact the rest of the air traffic system.'

The trouble began on Monday when over 25% of flights at UK airports faced cancellations.

Nats encountered what they labeled as a 'technical glitch,' rendering them unable to automatically process flight plans. Consequently, flights to and from UK airports were subject to restrictions while manual checks were conducted on these plans.

Although Nats reported the issue resolved at 3.15 pm on Monday, the disruption persisted into Tuesday due to aircraft and crews being displaced.

An analysis of flight data websites conducted by the PA news agency revealed that on Tuesday, a minimum of 281 flights, encompassing both departures and arrivals, were canceled at the UK's six busiest airports. Specifically, there were 75 cancellations at Gatwick, 74 at Heathrow, 63 at Manchester, 28 at Stansted, 23 at Luton, and 18 at Edinburgh.

In response to the air traffic control malfunction, EasyJet announced its plans to operate five repatriation flights to Gatwick and deploy larger aircraft on crucial routes.

It said: ‘During this traditionally very busy week for travel, options for returning to the UK are more limited on some routes and so easyJet will be operating five repatriation flights to London Gatwick over the coming days from Palma and Faro on August 30, and Tenerife and Enfidha on August 31 and from Rhodes on September 1.

‘We are also operating larger aircraft on key routes including Faro, Ibiza, Dalaman and Tenerife to provide some additional 700 seats this week.’